Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN954
_____________________________________________________________________

DATE                : 30/09/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):Systems running VLC versions prior to 3.0.24.
  
=====================================================================
https://forum.videolan.org/viewtopic.php?f=14&t=167768
_____________________________________________________________________

VLC 3.0.24 is now live!


Hello everyone,

VideoLAN and the VLC team are publishing the twenty-fifth release
of the VLC 3.0 branch, named "Vetinari", in reference to the Lord
Patrician from Discworld.

Version 3.0.24 brings a major upgrade from FFmpeg 4.4 to 8.1.2,
expected to improve decoding performance and fix playback issues
across a range of formats.

This update also includes:

    - Update 49 third-party dependencies
    - Add Atrac3/Atrac9 decoding support
    - Add CEA-708 closed captions support in MP4
    - Add SRT listener mode
    - Add SFTP public key authentication options and ED25519
hostkey support
    - Improve Qt6 support
    - Improve subtitle language detection and WebVTT handling
    - Improve Qt dialogs and effects window geometry saving
    - Switch RIST input and output to librist, with main and
simple profiles
    - Fix numerous crashes, leaks, hangs and malformed file
handling issues
    in MKV, MP4, MPEG-TS, Ogg, AVI and other demuxers
    - Fix a LibVLC media list player race
    - Add Super Resolution scaling with Moore Threads GPUs
    - Add NV12 DirectShow capture support on Windows
    - Fix Direct3D11 adjust filter issues and texture leaks
    - Fix Windows audio crashes, leaks and deadlocks
    - Fix slow Windows startup when Daylight Saving Time
changes
    - Fix the AudioToolbox MIDI synthesizer crash on
macOS 26 and later
    - Add Flatpak build support

This release also disables the RealRTSP plugin in all build
configurations, removes the NPAPI browser plugin and the
broken YouTube Lua script.

The updater now uses a new RSA-4096 key to verify updates.

3.0.24 also contains over 130 security fixes in VLC and its
bundled libraries, including fixes for out-of-bounds accesses,
integer overflows, double frees and use-after-free bugs.

The security advisories will be updated a few days after the
release.

Many thanks to the security researchers, the OSS-Fuzz project
and all contributors who helped find, report and fix these
issues.

Get the new version here! https://www.videolan.org/vlc/

Feel free to share your feedbacks or to report any issues in
reply to this topic.

Thank you for using VLC.

NB: Please tell us about the Windows start issue, this should
be fixed now.

NB 2: Update in VLC is coming soon as it's very fresh!

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================